{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "title": "oidc10_rp",
    "order": 3,
    "definitions": {
        "NameIDFormat": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
            "info": "This indicates whether the nameID is set to something random or the same every time the user logs in. Use transient if user does not need to be identified in a new session."
        },
        "ArpAttribute": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "source": {
                        "type": "string"
                    },
                    "value": {
                        "type": "string"
                    }
                }
            }
        }
    },
    "type": "object",
    "properties": {
        "id": {
            "type": "number"
        },
        "eid": {
            "type": "number"
        },
        "entityid": {
            "type": "string",
            "format": "basic-authentication-user"
        },
        "type": {
            "type": "string",
            "enum": [
                "oidc10-rp"
            ]
        },
        "revisionid": {
            "type": "number"
        },
        "state": {
            "type": "string",
            "enum": [
                "prodaccepted",
                "testaccepted"
            ]
        },
        "discoveryurl": {
            "type": [
                "string",
                "null"
            ],
            "format": "url"
        },
        "allowedall": {
            "type": "boolean"
        },
        "manipulation": {
            "type": [
                "string",
                "null"
            ]
        },
        "manipulationNotes": {
            "type": [
                "string",
                "null"
            ]
        },
        "user": {
            "type": "string"
        },
        "created": {
            "type": "string"
        },
        "revisionnote": {
            "type": "string"
        },
        "active": {
            "type": "boolean"
        },
        "allowedEntities": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    }
                }
            }
        },
        "allowedResourceServers": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    }
                }
            }
        },
        "arp": {
            "type": "object",
            "sources": [
                "idp",
                "ala",
                "orcid",
                "sab",
                "voot",
                "pseudo_email",
                "surfmarket_entitlements",
                "manage"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean"
                },
                "attributes": {
                    "properties": {
                        "urn:mace:dir:attribute-def:eduPersonTargetedID": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
                        },
                        "urn:mace:dir:attribute-def:eduPersonPrincipalName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                        },
                        "urn:mace:dir:attribute-def:displayName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.16.840.1.113730.3.1.241"
                        },
                        "urn:mace:dir:attribute-def:cn": {
                            "$ref": "#/definitions/ArpAttribute",
                            "description": "common name",
                            "alias": "urn:oid:2.5.4.3"
                        },
                        "urn:mace:dir:attribute-def:givenName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.5.4.42"
                        },
                        "urn:mace:dir:attribute-def:sn": {
                            "$ref": "#/definitions/ArpAttribute",
                            "description": "surname",
                            "alias": "urn:oid:2.5.4.4"
                        },
                        "urn:mace:dir:attribute-def:mail": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:0.9.2342.19200300.100.1.3"
                        },
                        "urn:mace:terena.org:attribute-def:schacHomeOrganization": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.9"
                        },
                        "urn:mace:terena.org:attribute-def:schacHomeOrganizationType": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.10"
                        },
                        "urn:schac:attribute-def:schacPersonalUniqueCode": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.14",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonAffiliation": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.1",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonScopedAffiliation": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.9",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonEntitlement": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.7",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonOrcid": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.16"
                        },
                        "urn:mace:dir:attribute-def:eduPersonAssurance": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.11"
                        },
                        "urn:mace:surf.nl:attribute-def:eckid": {
                            "$ref": "#/definitions/ArpAttribute"
                        },
                        "urn:mace:eduid.nl:1.1": {
                            "$ref": "#/definitions/ArpAttribute",
                            "display": "eduid"
                        },
                        "urn:mace:surf.nl:attribute-def:surf-crm-id": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.100.10.50.2"
                        },
                        "urn:mace:dir:attribute-def:isMemberOf": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.5.1.1",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:uid": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:0.9.2342.19200300.100.1.1"
                        },
                        "urn:mace:dir:attribute-def:preferredLanguage": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.16.840.1.113730.3.1.39"
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlEduPersonOrgUnit": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10.1",
                            "deprecated": true,
                            "multiplicity": true
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlEduPersonStudyBranch": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10",
                            "deprecated": true,
                            "multiplicity": true
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlStudielinkNummer": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10.3",
                            "deprecated": true
                        }
                    }
                }
            },
            "required": [
                "enabled",
                "attributes"
            ]
        },
        "notes": {
            "type": [
                "string",
                "null"
            ]
        },
        "metaDataFields": {
            "type": "object",
            "properties": {
                "NameIDFormat": {
                    "$ref": "#/definitions/NameIDFormat"
                },
                "mdrpi:RegistrationInfo": {
                    "type": "string",
                    "info": "The name of the authority that can register a service provider or identity provider."
                },
                "oidc:signingCertificateUrl": {
                    "type": "string",
                    "format": "url",
                    "info": "Enter the URL that provides to the public key to verify the signature of the client JWT."
                },
                "oidc:signingCertificate": {
                    "type": "string",
                    "format": "certificate",
                    "info": "The public JWT signing certificate of the service. This must be a PEM encoded certificate. DER, CRT or CER are not supported."
                },
                "oidc:consentRequired": {
                    "type": "boolean",
                    "info": "Select this option to force OIDC consent for a user for this RP.",
                    "default": false
                },
                "logo:0:url": {
                    "type": "string",
                    "format": "url",
                    "info": "Enter the URL to the logo used for this service. e.g. https://static.example-logo.nl/media/sp/logo.png."
                },
                "logo:0:width": {
                    "type": "number",
                    "info": "The width of the logo found at logo:0:url in pixels."
                },
                "logo:0:height": {
                    "type": "number",
                    "info": "The height of the logo found at logo:0:url in pixels."
                },
                "coin:push_enabled": {
                    "type": "boolean",
                    "default": false,
                    "info": "Must be set for this Service Provider to be included in the EB push despite being imported from eduGAIN."
                },
                "coin:exclude_from_push": {
                    "type": "boolean",
                    "default": false,
                    "info": "Must be set for this Service Provider to be excluded in the EB push."
                },
                "coin:additional_logging": {
                    "type": "boolean",
                    "info": "Set to get an extended form of logging."
                },
                "coin:institution_id": {
                    "type": "string",
                    "info": "The defined client code. Generally an abbreviation of the name of the client."
                },
                "coin:institution_guid": {
                    "type": "string",
                    "format": "uuid",
                    "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this service."
                },
                "coin:no_consent_required": {
                    "type": "boolean",
                    "info": "Select this option to skip the consent for a user.",
                    "default": true
                },
                "coin:eula": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the end-user license agreement (EULA) of the service provider."
                },
                "coin:ss:idp_visible_only": {
                    "type": "boolean",
                    "info": "Set to make invisible in the dashboard for institutions that are not connected to this service."
                },
                "coin:ss:aansluitovereenkomst_refused": {
                    "type": "boolean",
                    "info": "Set to indicate the service in the dashboard for institutions is marked as to have disagreed to sign the aansluitovereenkomst."
                },
                "coin:ss:hidden": {
                    "type": "boolean",
                    "info": "Set to make invisible in the dashboard for identity providers."
                },
                "coin:application_url": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL of the service used to log on."
                },
                "coin:supports_idp_init_login": {
                    "type": "boolean",
                    "info": "The service provider supports IDP initiated login."
                },
                "coin:transparant_issuer": {
                    "type": "boolean",
                    "info": "Set this to let the Engineblock use the EntityID of the IdP in stead of the EntityID of the Engineblock."
                },
                "coin:display_unconnected_idps_wayf": {
                    "type": "boolean",
                    "info": "Display unconnected IdPs in the WAYF."
                },
                "coin:policy_enforcement_decision_required": {
                    "type": "boolean",
                    "info": "Set to activate the user policy engine (PDP)."
                },
                "coin:service_team_id": {
                    "type": "string",
                    "info": "Enter the team name as used in the SP Dashboard. e.g. urn:collab:group:example-teams.nl:nl:surfnet:services:spd_example. "
                },
                "coin:privacy:what_data": {
                    "type": "string",
                    "info": "Explain in a sufficient level of detail what (types of) data, so not just attributes, are processed within the service."
                },
                "coin:privacy:access_data": {
                    "type": "string",
                    "info": "Explain what people or roles at which companies can access data, and if necessary to which extend."
                },
                "coin:privacy:country": {
                    "type": "string",
                    "info": "In what country or countries does the data reside; include both primary processing location(s) as well as for instance locations where backups live."
                },
                "coin:privacy:security_measures": {
                    "type": "string",
                    "info": "Explains what security measures are taken to protect data. You can also link to a page describing this."
                },
                "coin:privacy:certification": {
                    "type": "boolean",
                    "info": "Can a Third Party Memorandum (TPM) be supplied? e.g. ISO27001/2, ISAE3402, etc."
                },
                "coin:privacy:certification_location": {
                    "type": "string",
                    "info": "Where can customers find the mentioned certificates or how can they request access."
                },
                "coin:privacy:certification_valid_from": {
                    "type": "string",
                    "format": "date-time",
                    "info": "The date from which the Third Party Memorandum (TPM) is valid."
                },
                "coin:privacy:certification_valid_to": {
                    "type": "string",
                    "format": "date-time",
                    "info": "The date until the Third Party Memorandum (TPM) is valid."
                },
                "coin:privacy:surfmarket_dpa_agreement": {
                    "type": "boolean",
                    "info": "Has the service provider agreed a Data Processing Agreement (DPA) with SURFmarket?"
                },
                "coin:privacy:surfnet_dpa_agreement": {
                    "type": "boolean",
                    "info": "Is the service provider willing to sign the SURF model Data Processing Agreement (DPA)?"
                },
                "coin:privacy:sn_dpa_why_not": {
                    "type": "string",
                    "info": "Explains why the SP answered no on the subject of the SURFmarket DPA."
                },
                "coin:privacy:privacy_policy": {
                    "type": "boolean",
                    "info": "Does the SP publish an applicable privacy policy on a web page?"
                },
                "coin:privacy:privacy_policy_url": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the applicable privacy policy. "
                },
                "coin:privacy:other_info": {
                    "type": "string",
                    "info": "Other data privacy and security information that helps the institution decide whether it is OK to connect the service."
                },
                "coin:privacy:gdpr_is_in_wiki": {
                    "type": "boolean",
                    "info": "Set if the 'General Data Protection Regulation' (GDPR) is available on the SURF wiki. In Dutch known as 'Algemene Verordening Gegevensbescherming' (AVG). "
                },
                "coin:ss:license_status": {
                    "type": "string",
                    "enum": [
                        "license_required_by_service_provider",
                        "license_not_required",
                        "license_available_through_surfmarket"
                    ],
                    "default": "license_required_by_service_provider",
                    "info": "Set the applicable license for this service as provisioned by the SP Dashboard."
                },
                "coin:dashboard_connect_option": {
                    "type": "string",
                    "enum": [
                        "connect_with_interaction",
                        "connect_without_interaction_with_email",
                        "connect_without_interaction_without_email"
                    ],
                    "default": "connect_with_interaction",
                    "info": "Whether the IdP can connect to this RP without any interaction, and, if so, whether an email must be sent to the admin of the service"
                },
                "coin:stepup:requireloa": {
                    "type": "string",
                    "format": "url",
                    "enum": [
                        "http://test.surfconext.nl/assurance/loa2",
                        "http://test.surfconext.nl/assurance/loa3"
                    ],
                    "default": "http://test.surfconext.nl/assurance/loa2",
                    "info": "Set to require Stepup Authentication for this SP with the specified minimum Level of Assurance."
                },
                "coin:stepup:allow_no_token": {
                    "type": "boolean",
                    "info": "When Stepup Authentication is required for this SP, allow users without a registered token to log in regardless."
                },
                "coin:contractual_base": {
                    "type": "string",
                    "enum": [
                        "AO",
                        "IX",
                        "R&S+CoCo",
                        "Entree",
                        "Clarin"
                    ],
                    "default": "AO",
                    "info": "Set the contractual base that underlies a production SP / RP entity."
                },
                "secret": {
                    "type": "string",
                    "format": "password",
                    "info": "The secret of this Relying Party for authentication purposes."
                },
                "clientSecretJWT": {
                    "type": "string",
                    "format": "password",
                    "minLength": 32,
                    "info": "The JWT secret of this Relying Party for authentication purposes - minimal length 32 characters."
                },
                "redirectUrls": {
                    "type": "array",
                    "items": {
                        "type": "string",
                        "format": "url"
                    },
                    "info": "The redirect URI's of this Relying Party."
                },
                "scopes": {
                    "type": "array",
                    "items": {
                        "type": "string",
                        "fetch": "scopes"
                    },
                    "info": "The allowed scopes for this Relying Party."
                },
                "grants": {
                    "type": "array",
                    "items": {
                        "type": "string",
                        "enum": [
                            "authorization_code",
                            "implicit",
                            "refresh_token",
                            "client_credentials"
                        ]
                    },
                    "info": "The authorisation grant type's of this Relying Party."
                },
                "isResourceServer": {
                    "type": "boolean",
                    "default": false,
                    "info": "Must be set for this Relying Party to be marked as a Resource Server to explicitly grant access to the Introspect endpoint."
                },
                "isPublicClient": {
                    "type": "boolean",
                    "default": false,
                    "info": "Must be set for this Relying Party to be marked as a Public Client to explicitly allow the Proof Key for Code Exchange (PKCE) flow."
                },
                "accessTokenValidity": {
                    "type": "number",
                    "default": 3600,
                    "info": "The number of seconds that a new access token is valid for this Relying Party."
                },
                "refreshTokenValidity": {
                    "type": "number",
                    "default": 3600,
                    "info": "The number of seconds that a new refresh token is valid for this Relying Party."
                }
            },
            "patternProperties": {
                "^name:(en|nl|pt)$": {
                    "type": "string",
                    "info": "Set the name of the service. Format: 'Service Name | Supplier'"
                },
                "^displayName:(en|nl|pt)$": {
                    "type": "string",
                    "info": "Name as displayed in applications."
                },
                "^coin:ss:wiki_url:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "Add the URL to the SURF wiki for additional information of this service."
                },
                "^description:(en|nl|pt)$": {
                    "type": "string",
                    "info": "The description of the service."
                },
                "^coin:ss:type_of_service:(en|nl)$": {
                    "type": "string",
                    "info": "The type of service used in the facet search in dashboard."
                },
                "^NameIDFormats:([0-2]{1})$": {
                    "$ref": "#/definitions/NameIDFormat",
                    "multiplicity": 3,
                    "info": "The NameIDFormat(s) this service provider supports. This can be transient, transparant or unspecified."
                },
                "^contacts:([0-3]{1}):surName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The surname of the contact. e.g. for 'John Doe', 'Doe' is the surname."
                },
                "^contacts:([0-3]{1}):givenName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The given name of the contact. e.g. for 'John Doe', 'John' is the given name."
                },
                "^contacts:([0-3]{1}):emailAddress$": {
                    "type": "string",
                    "format": "local-email",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The e-mail address; syntax in accordance with RFC 5322. e.g. m.l.vermeegen@university.example.org."
                },
                "^contacts:([0-3]{1}):telephoneNumber$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The telephone number of the contact."
                },
                "^contacts:([0-3]{1}):isSirtfiSecurityContact$": {
                    "type": "boolean",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "Set the security contact for this service."
                },
                "^contacts:([0-3]{1}):contactType$": {
                    "type": "string",
                    "enum": [
                        "technical",
                        "support",
                        "administrative",
                        "billing",
                        "other"
                    ],
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "From the pull down, select the type of contact."
                },
                "^OrganizationName:(en|nl|pt)$": {
                    "type": "string",
                    "info": "The formal name of the organization. e.g. Service by University of Harderwijk."
                },
                "^OrganizationDisplayName:(en|nl|pt)$": {
                    "type": "string",
                    "info": "The friendly name of the organization. e.g. University of Harderwijk."
                },
                "^OrganizationURL:(en|nl|pt)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the website of the service e.g. http://www.example-service.nl/en/."
                },
                "^url:(en|nl|pt)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the support site of the service."
                },
                "^mdui:PrivacyStatementURL:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the Privacy Statement of the service."
                },
                "^mdrpi:RegistrationPolicy:(en|nl)$": {
                    "type": "string",
                    "info": "The URL to the Registration Policy of the service."
                },
                "^coin:entity_categories:([1-4]{1})$": {
                    "type": "string",
                    "enum": [
                        "http://refeds.org/category/research-and-scholarship",
                        "http://refeds.org/category/hide-from-discovery",
                        "http://www.geant.net/uri/dataprotection-code-of-conduct/v1",
                        "http://clarin.eu/category/clarin-member"
                    ],
                    "multiplicity": 4,
                    "startIndex": 1,
                    "info": "Select one of the entity categories applicable to this service. Entity Categories group federation entities that share common criteria."
                }
            },
            "required": [
                "name:en",
                "secret",
                "scopes",
                "grants"
            ],
            "additionalProperties": false
        }
    },
    "required": [
        "entityid",
        "state",
        "allowedall",
        "metaDataFields"
    ],
    "additionalProperties": false,
    "indexes": []
}